Description
SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid password-reset tokens mailed to victim recovery addresses within links pointing to attacker infrastructure, enabling account takeover.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Alinto | SOGo | < 5.12.11 | 5.12.11 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | sogo | 5.12.1-3+deb13u3 | — |
| Debian 12 | sogo | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | sogo | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | sogo | 5.12.4-1.2ubuntu0.1~esm2 | USN-8993-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
Faceless0x7/CVE-2026-93453 ★ 2 · Sep 18, 2026
CVE-2026-93453 Exploit — SOGo password reset link poisoning via attacker-controlled Origin header, enabling password reset token interception and account takeover.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- USN-8993-1 sogo vulnerability Ubuntu Security Notices (USN) · Nov 4, 2026
References
- https://www.sogo.nu/news/2026/sogo-v51211-released.html vendor-advisory
- https://github.com/Alinto/sogo/commit/382118a93b6925de2ce7f774abc1865ebea2dbba patch
- https://github.com/Alinto/sogo/commit/04a3e9823889acaf6c247b224f5f7a0108f8f829 patch
- https://github.com/Alinto/sogo/blob/SOGo-5.12.10/UI/MainUI/SOGoRootPage.m#L1375 technical-description
- https://github.com/Alinto/sogo product
- VulnCheck Advisory: SOGo before 5.12.11 Password Reset Token Interception via Origin Header third-party-advisory